In traditional cellular telephone networks, mobile nodes are able to roam between cells without the need to drop ongoing telephone calls. With the introduction of mobile IP services, solutions have been sought to allow mobile IP nodes to roam within and even between different access networks (such as UMTS or WLAN) with only the minimum disruption to services. The preferred solutions are based on the idea of allowing traffic flows to be redirected to the current location of the mobile node.
In one solution, known as Mobile IPv6, the traffic flows are identified by a stable IPv6 address and are routed to the home network of the mobile node before forwarding to the current “care-of-address” of the mobile node. When the mobile node roams between access nodes, an update message containing a new care-of-address is sent to the home network. In another solution known as Host Identity Protocol (HIP), a public key (or a hash of a public key) identifies the traffic flows. In either case, a stable forwarding agent is required somewhere in the network so that other nodes can contact the mobile node without previous knowledge of the current location of the mobile node.
In Mobile IPv6, this stable forwarding agent is called the Home Agent, and a security association must exist between the Home Agent and the mobile node in order to prevent unauthorised location updates being acted upon. In HIP, there is no need for such a security association as the public key can be used directly to identify a particular node in a secure manner. However, in order for other nodes to learn the public key of the HIP-based mobile node, this public key must be stored in a Domain Name System (DNS) server in a secure manner. Therefore, in both cases the mobile node must be capable of securely performing transactions with its “home network”, either for the purpose of talking to its Home Agent or for updating the DNS server to store its public key at the deployment phase.
Typically, the set-up of the security association (SA) for the home agent or the update of the DNS server might be performed manually. While parts of these operations have been automated, for instance through the use of a public key infrastructure, the authorisation step has to date remained a manual operation. In Mobile IPv6, this step involves a decision on whether the particular mobile node (even with a certificate from a trusted third party) is allowed to use a particular IPv6 address. This step is not easy to automate through public key infrastructure, given that the infrastructure would typically be unable to tell which IP address assignments are made in the network. In HIP, the procedure is easier but requires the existence of a public key infrastructure and requires that a determination has been made as to whether the mobile node is allowed to control the given domain name. The existence of such a public key infrastructure can be seen as redundant and unnecessary, given that the purpose of the DNS system is to act as a public key infrastructure—it would be strange to require another public key infrastructure to enter data into a DNS server.
The above technical problems are likely to lead to a service deployment problem in future networks. It is unacceptable from a business perspective to require manual work in order to set up each and every mobile node (out of millions) for the mobility service.